<!DOCTYPE html>
<html>

<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
	<meta name="theme-color" content="#33474d">
	<title>shell 练习-封ip | 失落的乐章</title>
	<link rel="stylesheet" href="/css/style.css" />
	
      <link rel="alternate" href="/atom.xml" title="失落的乐章" type="application/atom+xml">
    
</head>

<body>

	<header class="header">
		<nav class="header__nav">
			
				<a href="/archives" class="header__link">Archive</a>
			
				<a href="/tags" class="header__link">Tags</a>
			
				<a href="/atom.xml" class="header__link">RSS</a>
			
		</nav>
		<h1 class="header__title"><a href="/">失落的乐章</a></h1>
		<h2 class="header__subtitle">技术面前，永远都是学生。</h2>
	</header>

	<main>
		<article>
	
		<h1>shell 练习-封ip</h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/shell练习/">shell练习</a>
			</span>
		
	</div>

	

	
		<p>需求： 根据web服务器上的访问日志，把一些请求量非常高的ip给拒绝掉！ </p>
<p>分析： 我们要做的，不仅是要找到哪些ip请求量不合法，并且还要每隔一段时间把之前封掉的ip（若不再继续请求了）给解封。 所以该脚本的关键点在于定一个合适的时间段和阈值。 </p>
<p>比如， 我们可以每一分钟去查看一下日志，把上一分钟的日志给过滤出来分析，并且只要请求的ip数量超过100次那么就直接封掉。 而解封的时间又规定为每半小时分析一次，把几乎没有请求量的ip给解封！</p>
<p>参考日志文件片段：</p>
<blockquote>
<p>157.55.39.107 [20/Mar/2015:00:01:24 +0800] www.aminglinux.com “/bbs/thread-5622-3-1.html” 200 “-“ “Mozilla/5.0 (compatible; bingbot/2.0; +<a href="http://www.bing.com/bingbot.htm" target="_blank" rel="external">http://www.bing.com/bingbot.htm</a>)”<br>61.240.150.37 [20/Mar/2015:00:01:34 +0800] www.aminglinux.com “/bbs/search.php?mod=forum&amp;srchtxt=LNMP&amp;formhash=8f0c7da9&amp;searchsubmit=true&amp;source=hotsearch” 200 “-“ “Mozilla/5.0 (compatible; bingbot/2.0; +<a href="http://www.bing.com/bingbot.htm" target="_blank" rel="external">http://www.bing.com/bingbot.htm</a>)”</p>
</blockquote>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div></pre></td><td class="code"><pre><div class="line"><span class="meta">#! /bin/bash</span></div><div class="line">logfile=/home/logs/access.log</div><div class="line">d1=`date -d <span class="string">"-1 minute"</span> +%H:%M`</div><div class="line">d2=`date +%M`</div><div class="line">ipt=/sbin/iptables</div><div class="line">ips=/tmp/ips.txt</div><div class="line"></div><div class="line"><span class="function"><span class="title">block</span></span>()&#123;</div><div class="line">    grep <span class="string">"<span class="variable">$d1</span>:"</span> <span class="variable">$logfile</span>|awk <span class="string">'&#123;print $1&#125;'</span> |sort -n |uniq -c |sort -n &gt;<span class="variable">$ips</span></div><div class="line">    <span class="keyword">for</span> ip <span class="keyword">in</span> `awk <span class="string">'$1&gt;100 &#123;print $2&#125;'</span> <span class="variable">$ips</span>`; <span class="keyword">do</span></div><div class="line">        <span class="variable">$ipt</span> -I INPUT -p tcp --dport 80 -s <span class="variable">$ip</span> -j REJECT</div><div class="line">        <span class="built_in">echo</span> <span class="string">"`date +%F-%T` <span class="variable">$ip</span>"</span> &gt;&gt; /tmp/badip.txt</div><div class="line">    <span class="keyword">done</span></div><div class="line">&#125;</div><div class="line"></div><div class="line"><span class="function"><span class="title">unblock</span></span>()&#123;</div><div class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> `<span class="variable">$ipt</span> -nvL --line-numbers |grep <span class="string">'0.0.0.0/0'</span>|awk <span class="string">'$2&lt;15 &#123;print $1&#125;'</span>|sort -nr`; <span class="keyword">do</span></div><div class="line">        <span class="variable">$ipt</span> -D INPUT <span class="variable">$i</span></div><div class="line">    <span class="keyword">done</span></div><div class="line">    <span class="variable">$ipt</span> -Z</div><div class="line">&#125;</div><div class="line"></div><div class="line"><span class="keyword">if</span> [ <span class="variable">$d2</span> == <span class="string">"00"</span> ] || [ <span class="variable">$d2</span> == <span class="string">"30"</span> ]; <span class="keyword">then</span></div><div class="line">    unblock</div><div class="line">    block</div><div class="line"><span class="keyword">else</span></div><div class="line">    block</div><div class="line"><span class="keyword">fi</span></div></pre></td></tr></table></figure>
	

	
		<span class="different-posts"><a href="/2017/10/12/Shell 练习/17. shell 练习-封ip/" onclick="window.history.go(-1); return false;">⬅️ Go back </a></span>

	

</article>

	</main>

	<footer class="footer">
	<div class="footer-content">
		
	      <div class="footer__element">
	<p>Hi there, <br />welcome to my Blog glad you found it. Have a look around, will you?</p>
</div>

	    
	      <div class="footer__element">
	<h5>Check out</h5>
	<ul class="footer-links">
		<li class="footer-links__link"><a href="/archives">Archive</a></li>
		
		  <li class="footer-links__link"><a href="/atom.xml">RSS</a></li>
	    
		<li class="footer-links__link"><a href="/about">about page</a></li>
		<li class="footer-links__link"><a href="/tags">Tags</a></li>
		<li class="footer-links__link"><a href="/categories">Categories</a></li>
	</ul>
</div>

	    

		<div class="footer-credit">
			<span>© 2017 失落的乐章 | Powered by <a href="https://hexo.io/">Hexo</a> | Theme <a href="https://github.com/HoverBaum/meilidu-hexo">MeiliDu</a></span>
		</div>

	</div>


</footer>



</body>

</html>
